throw if auth header header not present/empty

[ryzokuken]

IIUC, the middleware currently proceeds normally if auth header is not present or is empty.

There should be a way to require a valid auth and fail on those cases.

[ryzokuken]

For now, I've hardcoded the other behavior in a fork (ryzokuken@5e0857e) and used it in my project as a stopgap measure. Perhaps we could add options like bail_without_header on the structs that could be set by the caller on initialization and check those like should_401_on_multiple_values()... maybe a configurable should_401_without_auth()? Would you accept a PR with that change?